Analysis

  • max time kernel
    8s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 17:08

General

  • Target

    0b6cd2b1e18193ba33edbd6a3fc464a6e302f0da7f881dd48aedbf6ba993aa32.exe

  • Size

    312KB

  • MD5

    db1fbaf680dc245b486db86fa852f655

  • SHA1

    355caa80363bc44607efcce4c64d3752a0edf286

  • SHA256

    0b6cd2b1e18193ba33edbd6a3fc464a6e302f0da7f881dd48aedbf6ba993aa32

  • SHA512

    ec923d035cd6d608315c7a7dbd3ffd66afea22dace6f0854e7e97346ca758f6344c32a6a7336e9fd1506207bdee1e408f4a328b7671c7d9248a64e8a56c2e840

  • SSDEEP

    6144:ebVv6RXCrNabG9wcT7XVwBIQv6B2M4m2FxHrkRQyczK+VcpKTCcTj:ebGXCNXX1wus6B2Mo1mKcFcT

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

45.91.202.63:25415

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b6cd2b1e18193ba33edbd6a3fc464a6e302f0da7f881dd48aedbf6ba993aa32.exe
    "C:\Users\Admin\AppData\Local\Temp\0b6cd2b1e18193ba33edbd6a3fc464a6e302f0da7f881dd48aedbf6ba993aa32.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:4012
      • C:\Users\Admin\AppData\Local\Temp\filename.exe
        "C:\Users\Admin\AppData\Local\Temp\filename.exe"
        3⤵
          PID:2840
          • C:\ProgramData\Path\Path.exe
            "C:\ProgramData\Path\Path.exe"
            4⤵
              PID:4616
              • C:\Windows\SysWOW64\schtasks.exe
                "schtasks.exe" /create /tn Path /tr "C:\ProgramData\Path\Path.exe" /st 17:10 /du 23:59 /sc daily /ri 1 /f
                5⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2924
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9352.tmp.cmd""
              4⤵
                PID:4388
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 6
                  5⤵
                  • Delays execution with timeout.exe
                  PID:3172
        • C:\ProgramData\Path\Path.exe
          C:\ProgramData\Path\Path.exe
          1⤵
            PID:4924

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\TmpC469.tmp

            Filesize

            2KB

            MD5

            1420d30f964eac2c85b2ccfe968eebce

            SHA1

            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

            SHA256

            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

            SHA512

            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

          • C:\Users\Admin\AppData\Local\Temp\filename.exe

            Filesize

            426KB

            MD5

            556a8b2afef96f81acde6ca1a525650e

            SHA1

            262909e4686aba13de7ca5a2bf187871fc4fe63b

            SHA256

            b867d368d4597334a036b46816473be270d6779db2428aae75053af8cacf1e85

            SHA512

            52a954cf545b6bfc2057a09b858074bd1dcedd75a3983dff14bc9e72b2da47c375f30568a9310e2751e57291e9186b39d5b8d228f855102631ab95f9743b33d9

          • C:\Users\Admin\AppData\Local\Temp\tmp9352.tmp.cmd

            Filesize

            160B

            MD5

            38025b5fb79e551699e2a4b5a1a45b52

            SHA1

            fe014f92503dd538d8ecb76d9fed64325629a241

            SHA256

            cc73d6fe28fbd971e9a90198ea50cf44068be363270f40716c136cbb36c0b88e

            SHA512

            285e32896d7ca4c4546c843249f8739dae23eb2d8647b42d3e9e0ac6f83e948eb653e796525b61d6731a580f2bfb193791ff413b3321eb48301d59a0851367aa

          • memory/2840-77-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/2840-60-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/2840-57-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/2840-56-0x0000000000980000-0x00000000009F0000-memory.dmp

            Filesize

            448KB

          • memory/4012-33-0x0000000006B90000-0x0000000006BA2000-memory.dmp

            Filesize

            72KB

          • memory/4012-44-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/4012-9-0x0000000005590000-0x000000000559A000-memory.dmp

            Filesize

            40KB

          • memory/4012-27-0x0000000006460000-0x00000000064D6000-memory.dmp

            Filesize

            472KB

          • memory/4012-28-0x0000000006AC0000-0x0000000006ADE000-memory.dmp

            Filesize

            120KB

          • memory/4012-31-0x0000000007100000-0x0000000007718000-memory.dmp

            Filesize

            6.1MB

          • memory/4012-32-0x0000000006C50000-0x0000000006D5A000-memory.dmp

            Filesize

            1.0MB

          • memory/4012-3-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

          • memory/4012-34-0x0000000006BF0000-0x0000000006C2C000-memory.dmp

            Filesize

            240KB

          • memory/4012-35-0x0000000006D60000-0x0000000006DAC000-memory.dmp

            Filesize

            304KB

          • memory/4012-36-0x0000000006EA0000-0x0000000006F06000-memory.dmp

            Filesize

            408KB

          • memory/4012-59-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/4012-40-0x00000000070B0000-0x0000000007100000-memory.dmp

            Filesize

            320KB

          • memory/4012-41-0x0000000007CF0000-0x0000000007EB2000-memory.dmp

            Filesize

            1.8MB

          • memory/4012-43-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/4012-42-0x00000000083F0000-0x000000000891C000-memory.dmp

            Filesize

            5.2MB

          • memory/4012-10-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/4012-6-0x0000000005AB0000-0x0000000006054000-memory.dmp

            Filesize

            5.6MB

          • memory/4012-8-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/4012-7-0x00000000055A0000-0x0000000005632000-memory.dmp

            Filesize

            584KB

          • memory/4072-39-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/4072-5-0x0000000074790000-0x0000000074F40000-memory.dmp

            Filesize

            7.7MB

          • memory/4072-0-0x000000007479E000-0x000000007479F000-memory.dmp

            Filesize

            4KB

          • memory/4072-1-0x0000000000680000-0x00000000006D4000-memory.dmp

            Filesize

            336KB